WO2025123802A1 - Packet inspection and analysis system and method based on deep flow inspection - Google Patents

Abstract

The present invention relates to the technical field of packet inspection. Disclosed are a packet inspection and analysis system and method based on deep flow inspection. The system comprises a data acquisition module, a deep flow inspection module, a packet analysis module, a data storage module, and a security module; the data acquisition module is used for acquiring production data stream information transmitted by a packet in a network; the deep flow inspection module is used for performing flow feature extraction on a packet data stream and determining an application type; the packet analysis module is used for determining whether the packet is normal; the data storage module is used for storing packet flow data; and the security module is used for checking packet information and network connection condition. According to the present invention, deep flow inspection technology is used to identify the application type of the data stream, without being affected by encryption of application layer data; and a Bayesian classifier is used for continuing to perform classification in a major category, which only depends on statistical properties of the data, thereby achieving high efficiency and accuracy when determining whether the encrypted packet is normal.

Description

A message detection and analysis system and method based on deep flow detection Technical Field

The present invention relates to the technical field of message detection, and in particular to a message detection and analysis system and method based on deep flow detection.

Background Art

Deep flow detection technology is an application identification technology based on traffic behavior. It takes flow as the basic research object and extracts flow features, such as flow size and flow speed, from huge network flow data. Deep flow detection technology is mainly divided into three parts: flow feature selection, flow feature extraction, and classifier. Deep flow detection uses an application identification technology based on traffic behavior. This technology detects and identifies different application types by analyzing data packets in network traffic. Different application types have different manifestations in network traffic. Therefore, deep flow detection technology can identify different application types based on the traffic behavior of data packets. Deep flow detection technology can only classify application types in general and cannot accurately locate specific application types. This is because deep flow detection technology mainly focuses on the behavioral characteristics of network traffic. When a traffic meets a certain specific behavioral model, deep flow detection technology will classify it as the corresponding application type, such as P2P traffic or VOIP traffic.

To determine whether a service is normal, it is usually necessary to understand the specific type of application. Different application types have different traffic characteristics and behavior patterns. HTTP and HTTPS are both web browsing application types based on the TCP protocol, and their traffic characteristics and behavior patterns are very similar; however, the distribution of flow characteristics of HTTP and HTTPS is not exactly the same. The same traffic characteristics, when the application types are HTTP and HTTPS, are located in different positions in the flow characteristic distribution diagrams of HTTP and HTTPS, and need to be determined separately to determine whether the service is normal; therefore, when deep flow detection technology can only distinguish data flow application types by broad categories, how to determine whether the service is normal becomes a problem that needs to be solved.

Summary of the invention

The purpose of the present invention is to provide a packet detection and analysis system and method based on deep flow detection. To solve the problems raised in the above background technology.

In one aspect of the present invention, a message detection and analysis system based on deep flow detection is provided, comprising: a data acquisition module, a deep flow detection module, a message analysis module, a data storage module and a security module; the output end of the data acquisition module is interconnected with the input end of the deep flow detection module and the data storage module, and is used to collect data flow information produced by message transmission in the network; the output end of the deep flow detection module is interconnected with the input end of the message analysis module, and is used to extract flow features of the message data flow and determine the application type of the message data flow; the output end of the message analysis module is interconnected with the input end of the security module, and is used to determine whether the message is normal; the data storage module is interconnected with the deep flow detection module and the message analysis module, and is used to store message traffic data; when the message analysis module determines that the message data flow is abnormal, the security module checks the message information and network connection status, and notifies the administrator to take measures.

Specifically, the deep flow detection module also includes a data preprocessing unit, a flow feature extraction unit, a data flow classification unit and an optimization unit; the data preprocessing unit is used to preprocess the message flow data; the flow feature extraction unit is used to extract the flow features of the message flow from the message flow data; the data flow classification unit is used to perform supervised classification and identification of the application type of the message data flow; the optimization unit trains and optimizes the data flow classification unit according to the known message flow data and application type to improve the accuracy and robustness; the message analysis module also includes an unsupervised classification unit, an application type judgment unit and a detection unit; the unsupervised classification unit is used to find the historical data flow related to the message data flow, and the application type judgment unit is used to Determine the probability that the message data flow belongs to different application types; the monitoring unit is used to determine whether the message data flow is normal; the data storage module stores the probability that the data flow belongs to each application type and the abnormal rate of each application type through a 3×n-order matrix; the first row of elements are 1, 2, ... n, representing n different application types; the second row of elements represents the probability that the data flow belongs to each application type, and the third row of elements represents the probability that the message data flow is abnormal when the message data flow belongs to each application type; each 3×n-order matrix corresponds to the flow feature data of a message, as the flow feature data of the message increases, only the data at the corresponding position in the 3×n-order matrix needs to be updated, and when the same flow feature data appears, it is determined whether the message is normal according to the data in the matrix, and there is no need to update the message flow Analyze the quantity data.

In another aspect of the present invention, a packet detection and analysis method based on deep flow inspection is provided, comprising the following steps:

S5-1, obtaining flow characteristic data of a data flow, where the data flow refers to a data flow generated when a message is transmitted in a network;

S5-2, based on the flow characteristic data of the data flow, the application type of the data flow is first determined by a supervised classification model. If the application type of the data flow is not unique, the process proceeds to step S5-3; if the application type of the data flow is unique, the process proceeds to step S5-4;

If the flow characteristics of the data flow do not match the flow characteristics of any known application type, the message data flow is directly judged to be abnormal. The abnormal flow characteristics of the data flow may be caused by network problems or problems with the data itself. The security module will check the network connection status and message information.

S5-3, based on the data flow application type determined for the first time, determine the probability that the data flow belongs to each application type; determine the probability that the data flow is abnormal when it belongs to different application types according to the application type and flow characteristic data of the data flow; and determine whether the data flow is normal by combining all abnormal probabilities;

S5-4, judging whether the data flow is normal according to the application type and flow characteristic data of the data flow.

In step S5-2, the application type of the data stream is first determined by the supervised classification model, which specifically includes the following steps:

S6-1, obtaining historical data flow information, including flow characteristics and application types of data flows;

S6-2, for each application type, a binary classification model is trained with the flow features of the historical data flow as input and the application type as output, and a total of n binary classification models are obtained, where n is the number of application types;

S6-3, inputting the flow characteristics of the current data flow into n binary classification models to determine one or more application types that match the flow characteristics of the current data flow;

For data flows belonging to the same category of application types, the flow characteristics are very similar, and it is difficult to distinguish the application types in detail through the classification model. Here, a supervised classification model is used to determine the application types that are related to the current data flow. One or more application types that match the flow characteristics of the data flow are found to find the possible application type of the current data flow;

In step S5-3, determining the probability that the data flow belongs to each application type includes the following steps:

S7-1, _a1 , _a2 , ... _am represent the elements corresponding to the data flow application type determined for the first time, where m is the number of application types that match the flow characteristics of the current data flow; when m is 2, the elements corresponding to the data flow application type are _a1 and _a2 ;

S7-2, X ₁ , X ₂ , ...X _k represent the flow characteristics of the data flow, Y represents the random variable of the application type, the value range of Y is {a ₁ , a ₂ , ... _am }, and k is the number of flow characteristics;

S7-3, calculating the probability _Pa1 , _Pa2 , ...Pam that the data flow belongs to application types _a1 , _a2 , ... _{am ;}

Calculate m conditional probabilities,

Determine Pa ₁ , Pa ₂ , ... Pa _m , The value range of i is a positive integer between the interval [1, m];

The flow characteristics X ₁ , X ₂ , ...X _k of the data flow are known. When the flow characteristics X ₁ , X ₂ , ...X _k are known, the probability that the data flow belongs to each application type is calculated using the conditional probability formula. The higher the conditional probability, the higher the probability that the data flow belongs to a certain application type. Since the denominators in the calculation formula are all the same, only the numerators need to be compared. Here, the application type corresponding to the maximum conditional probability is not simply used as the current data flow application type, but the application type of the current data flow is expressed in the form of probability;

P{Y＝a _i } is the probability that the data flow belongs to application type a _i , which is obtained by calculating the ratio of the number of data flows of application type a _i in the data storage module to the total number of data flows in the data storage module; P{X ₁ ,X ₂ ,…X _k |Y＝a _i } is equal to P{X ₁ ,X ₂ ,…X _k ,Y＝a _i }, the number quantity of data flows with application type a _i and flow characteristics X ₁ ,X ₂ ,…X _k in the data storage module is determined, and the ratio of quantity to the total number of data flows in the data storage module is calculated to obtain P{X ₁ ,X ₂ ,…X _k |Y＝a _i };

S7-4, fill Pa ₁ , Pa ₂ , ...Pa _m into the corresponding positions of the second row in the 3×n-order matrix.

In step S5-3, determining the probability of abnormality when the data stream belongs to different application types includes the following steps:

S8-1, taking the flow characteristics of the current data flow and the flow characteristics of the historical data flow as input, performing unsupervised classification, and determining the classification cluster to which the flow characteristics of the current data flow belong;

S8-2, in the classification cluster to which the flow characteristics of the current data flow belong, find the flow characteristic data of application types _a1 , _a2 , ... _am , and record them as The superscript indicates the application type of the flow feature data, and the subscripts b ₁ , b ₂ , ... b _m respectively indicate the number of flow feature data with application types a ₁ , a ₂ , ... a _m in the classification cluster to which the flow feature of the current data flow belongs;

S8-3, for each flow feature data in step S8-2, calculate the probability of abnormality, denoted as

In particular, in step S5-4, the flow characteristics of the current data flow only match one application type, and only the abnormal probability of one application type needs to be calculated, that is, the probability that the current data flow is abnormal. If it is greater than or equal to the threshold, it is judged that the data flow generated when the current message is transmitted in the network is abnormal. If it is less than the threshold, it is judged that the data flow generated when the current message is transmitted in the network is normal.

S8-4, determine the probability that each application type _a1 , _a2 , ... _am is abnormal In the formula is the connection weight of the stream feature data; Fill in the corresponding position of the third row in the 3×n-order matrix;

Each flow feature data is distributed in different locations in different application types, and has different effects on judging whether the message is normal. For example, HTTP and HTTPS traffic features and behavior patterns are very similar. Since HTTPS needs to be encrypted, additional information needs to be added to the beginning of the data packet, such as the encryption algorithm identifier and key. This information will increase the size of the entire data packet. For the same data packet size quan, which meets the traffic features of both HTTP and HTTPS, in the HTTP flow features, quan may be at the average value, while in the HTTPS traffic features, quan will be in front of the average value. The impact of whether the message data is normal or not is not exactly the same;

S8-5, calculate the probability PE of the current data flow being abnormal, If PE is greater than or equal to the threshold, the data flow generated when the current message is transmitted in the network is judged to be abnormal; if PE is less than the threshold, the data flow generated when the current message is transmitted in the network is judged to be normal;

The threshold is calculated by the flow feature data of the abnormal historical data flow in the data storage module according to the above steps to obtain the probability that the data flow is abnormal, and the 25% quantile of the abnormal probability corresponding to the flow feature data of all abnormal historical data flows is taken as the threshold. Other values such as the average value, minimum value or median can also be used as the threshold according to needs.

In step S8-4, the connection weight of the stream feature data is determined by the following steps:

Calculate flow characteristic data The Euclidean distance between the stream feature data of the current data stream and the Euclidean distance is recorded as Map the Euclidean distance through the anti-correlation function f and get

Calculate the weight of each stream feature data In the summation formula, j only represents a sequence number and has no practical meaning;

The anti-correlation function f can be etc., where c is a non-zero positive constant, and x is the input of the anti-correlation function f; when c is 0 and the Euclidean distance between the existing stream feature data and the stream feature data of the current data stream is 0, The value of tends to infinity, so c is a positive constant greater than 0;

In particular, the weight of the flow feature data It can be used to calculate the probability Pa ₁ , Pa ₂ , ...Pa _m that the data flow belongs to the application type a ₁ , a ₂ , ... _am , and execute steps S8-1 and S8-2 to obtain the weight of the flow feature data. For each stream feature data, step S7-3 is executed to obtain a set of Pa ₁ , Pa ₂ , ...Pa _m , connecting Pa ₁ , Pa ₂ , ...Pa _m obtained from flow feature data of the same application type through weights can obtain the probability that the current data flow belongs to application type a ₁ , a ₂ , ... _am .

Specifically, in step S8-3, for each flow feature data in step S8-2, calculating the probability of abnormality includes the following steps:

by represents any stream feature data, the value range of x is a positive integer between [1, _bi ]; in the stream feature data of the historical data stream of application type a _i , determine The total number of the same stream feature data, The number of times the same flow feature data is abnormal is calculated as the ratio of the abnormal number to the total number as the flow feature data. abnormal probability.

Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the deep flow detection technology identifies the application type of the data flow according to the characteristics of the flow, different application types are reflected in different states on the session connection or data flow, and the flow characteristics of the entire data flow are analyzed, such as the average packet length of each flow, the time interval for the arrival of each packet, etc., without the need to detect the application layer data, so the detection effect will not be affected by the encryption of the application layer data; after determining the major category of the application type, the Bayesian classifier is used to continue classification in the major category of the application program, which is insensitive to noise and outliers, and only relies on the statistical properties of the data itself without knowing the specific content of the data, and has high efficiency and accuracy in judging whether the encrypted message is normal.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

FIG1 is a schematic diagram of the structure of a message detection and analysis system based on deep flow inspection according to an embodiment of the present invention.

DETAILED DESCRIPTION

The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, ordinary technicians in this field will not make any creative efforts. All other embodiments obtained under the premise of sexual labor are within the scope of protection of the present invention.

In an embodiment of the present invention, please refer to Figure 1, which provides a message detection and analysis system based on deep flow detection, including: a data acquisition module, a deep flow detection module, a message analysis module, a data storage module and a security module; the output end of the data acquisition module is interconnected with the input end of the deep flow detection module and the data storage module, and is used to collect data flow information produced by message transmission in the network; the output end of the deep flow detection module is interconnected with the input end of the message analysis module, and is used to extract flow features of the message data flow and determine the application type of the message data flow; the output end of the message analysis module is interconnected with the input end of the security module, and is used to determine whether the message is normal; the data storage module is interconnected with the deep flow detection module and the message analysis module, and is used to store message traffic data; when the message analysis module determines that the message data flow is abnormal, the security module checks the message information and network connection status, and notifies the administrator to take measures.

The deep flow detection module also includes a data preprocessing unit, a flow feature extraction unit, a data flow classification unit and an optimization unit; the data preprocessing unit is used to preprocess the message flow data; the flow feature extraction unit is used to extract the flow features of the message flow from the message flow data; the data flow classification unit is used to perform supervised classification and identification of the application type of the message data flow; the optimization unit trains and optimizes the data flow classification unit according to the known message flow data and application type to improve the accuracy and robustness.

The message analysis module also includes an unsupervised classification unit, an application type judgment unit and a detection unit; the unsupervised classification unit is used to find historical data flows related to message data flows, the application type judgment unit is used to determine the probability that the message data flows belong to different application types; the monitoring unit is used to determine whether the message data flows are normal.

The data storage module stores the probability of data flow belonging to each application type and the abnormal rate of each application type through a 3×n-order matrix; the first row of elements are 1, 2, ... n, representing n different application types; the second row of elements represents the probability of data flow belonging to each application type, and the third row of elements represents the probability of abnormal message data flow when the message data flow belongs to each application type; each 3×n-order matrix corresponds to the flow feature data of a message, and as the flow feature data of the message increases, only the 3×n-order matrix needs to be updated The data at the corresponding position in the matrix is used to determine whether the message is normal, and there is no need to analyze the message flow data.

In an embodiment of the present invention, a packet detection and analysis method based on deep flow inspection is provided, comprising the following steps:

S5-1, obtaining flow characteristic data of a data flow, wherein the data flow refers to a data flow generated when a message is transmitted in a network; the flow characteristic data is extracted from the data flow by a deep flow inspection module, including but not limited to a packet size, a number of packets, a flow rate, and a duration of the flow;

S5-2, based on the flow characteristic data of the data flow, the application type of the data flow is first determined by a supervised classification model. If the application type of the data flow is not unique, the process proceeds to step S5-3; if the application type of the data flow is unique, the process proceeds to step S5-4;

The steps to determine the application type of the data flow for the first time are as follows:

Obtain historical data flow information, including flow characteristics and data flow application types;

For each application type, a binary classification model is trained with the flow features of the historical data flow as input and the application type as output. A total of n binary classification models are obtained, where n is the number of application types.

Inputting the flow characteristics of the current data flow into n binary classification models to determine one or more application types that match the flow characteristics of the current data flow;

S5-3, based on the data flow application type determined for the first time, determine the probability that the data flow belongs to each application type; determine the probability that the data flow is abnormal when it belongs to different application types according to the application type and flow characteristic data of the data flow; and determine whether the data flow is normal by combining all abnormal probabilities;

First, determine the probability that the data flow belongs to each application type, which includes the following steps:

a ₁ , a ₂ , ... a _m represent the elements corresponding to the data stream application type determined for the first time, where m is the number of application types that match the flow characteristics of the current data stream; when m is 2, the elements corresponding to the data stream application type are a ₁ and a ₂ ;

Let _X1 , _X2 , _X3 , _X4 represent the packet size, number of packets, flow rate and duration of the flow. Let Y represent the random variable of application type, and the value range of Y is {a ₁ , a ₂ , … a _m };

Calculate the probability Pa ₁ , Pa ₂ , ...Pa _m that the data flow belongs to application type a ₁ , a ₂ , ... _am ;

Pa ₁ , Pa ₂ , ... Pa _m , The value range of i is a positive integer between the interval [1, m];

Fill Pa ₁ , Pa ₂ , ...Pa _m into the corresponding positions of the second row in the 3×n-order matrix;

Next, determining the probability that each current data flow is abnormal when belonging to each application type includes the following steps:

S8-1, taking the packet size, number of packets, flow rate and flow duration of the current data flow and the historical data flow as input, performing unsupervised classification to determine the classification cluster to which the flow feature of the current data flow belongs;

S8-2, in the classification cluster to which the flow characteristics of the current data flow belong, find the flow characteristic data of application types _a1 , _a2 , ... _am , and record them as The superscript indicates the application type of the flow feature data, and the subscripts b ₁ , b ₂ , ... b _m respectively indicate the number of flow feature data with application types a ₁ , a ₂ , ... a _m in the classification cluster to which the flow feature of the current data flow belongs;

S8-3, for each flow feature data in step S8-2, calculate the probability of abnormality, denoted as

by represents any stream feature data, the value range of x is a positive integer between [1, _bi ]; in the stream feature data of the historical data stream of application type a _i , determine The total number of the same stream feature data, The number of times the same flow feature data is abnormal is calculated as the ratio of the abnormal number to the total number as the flow feature data. The probability of abnormality;

S8-4, calculate the flow characteristic data With the current data stream The Euclidean distance between the flow feature data is recorded as Map the Euclidean distance through the anti-correlation function e ^-x to obtain Calculate the weight of each stream feature data In the summation formula, j only represents a sequence number and has no practical meaning;

Determine the probability that each application type a ₁ , a ₂ , ... a _m is abnormal In the formula is the connection weight of the stream feature data; Fill in the corresponding position of the third row in the 3×n-order matrix;

S8-5, calculate the probability PE of the current data flow being abnormal, If PE is greater than or equal to the threshold, the data flow generated when the current message is transmitted in the network is judged to be abnormal; if PE is less than the threshold, the data flow generated when the current message is transmitted in the network is judged to be normal;

When the deep flow detection module determines through binary classification that the application types that match the flow characteristics of the current data flow are _a1 , _a2 , and _a3 , the historical flow characteristic data of application type _a1 in the classification cluster to which the flow characteristics of the current data flow belong The Euclidean distances between the stream feature data of the current data stream are 0, 0, 0.1, and 0.1 respectively, and the historical stream feature data of application type a ₂ The Euclidean distances between the stream feature data of the current data stream are 0.3, 0.3, and 0.2 respectively, and the historical stream feature data of application type a ₃ When the Euclidean distances between the stream feature data of the current data stream are 0.5 and 0.4 respectively, the weight of each stream feature data in each application type is first calculated.

When the application types of the current data flow are a ₁ , a ₂ and a ₃ , the probability of abnormal They are: The abnormal probability of the current data flow

S5-4, based on the unique application type and flow characteristic data determined by the current data flow, calculate the probability that the current data flow is abnormal. If it is greater than or equal to the threshold, the data flow generated when the current message is transmitted in the network is judged to be abnormal. If it is less than the threshold, the data flow generated when the current message is transmitted in the network is judged to be normal.

It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (10)

A message detection and analysis system based on deep flow detection, characterized in that it includes: a data acquisition module, a deep flow detection module, a message analysis module, a data storage module and a security module; the output end of the data acquisition module is interconnected with the input end of the deep flow detection module and the data storage module, and is used to collect data flow information produced by message transmission in the network; the output end of the deep flow detection module is interconnected with the input end of the message analysis module, and is used to extract flow features of the message data flow and determine the application type of the message data flow; the output end of the message analysis module is interconnected with the input end of the security module, and is used to determine whether the message is normal; the data storage module is interconnected with the deep flow detection module and the message analysis module, and is used to store message traffic data; when the message analysis module determines that the message data flow is abnormal, the security module checks the message information and network connection status, and notifies the administrator to take measures. According to a message detection and analysis system based on deep flow detection according to claim 1, it is characterized in that the deep flow detection module also includes a data preprocessing unit, a flow feature extraction unit, a data flow classification unit and an optimization unit; the data preprocessing unit is used to preprocess the message flow data; the flow feature extraction unit is used to extract the flow features of the message flow from the message flow data; the data flow classification unit is used to perform supervised classification and identification of the application type of the message data flow; the optimization unit trains and optimizes the data flow classification unit according to the known message flow data and application type to improve the accuracy and robustness. According to a message detection and analysis system based on deep flow detection according to claim 1, it is characterized in that the message analysis module also includes an unsupervised classification unit, an application type judgment unit and a detection unit; the unsupervised classification unit is used to find historical data flows related to message data flows, and the application type judgment unit is used to determine the probability that the message data flows belong to different application types; the monitoring unit is used to determine whether the message data flow is normal. According to a message detection and analysis system based on deep flow detection in claim 1, it is characterized in that the data storage module stores the probability of the data flow belonging to each application type and the abnormal rate of each application type through a 3×n-order matrix; the elements of the first row are 1, 2, ... n, indicating n different The elements in the second row represent the probability that the data flow belongs to each application type. The elements in the third row represent the probability that the message data flow is abnormal when the message data flow belongs to each application type. Each 3×n-order matrix corresponds to the flow feature data of a message. As the flow feature data of the message increases, it is only necessary to update the data at the corresponding position in the 3×n-order matrix. When the same flow feature data appears, it is determined whether the message is normal based on the data in the matrix, and there is no need to analyze the message traffic data. A packet detection and analysis method based on deep flow inspection, characterized in that it comprises the following steps: S5-1, obtaining flow characteristic data of a data flow, where the data flow refers to a data flow generated when a message is transmitted in a network; S5-2, based on the flow characteristic data of the data flow, the application type of the data flow is first determined by a supervised classification model. If the application type of the data flow is not unique, the process proceeds to step S5-3; if the application type of the data flow is unique, the process proceeds to step S5-4; S5-3, based on the data flow application type determined for the first time, determine the probability that the data flow belongs to each application type; determine the probability that the data flow is abnormal when it belongs to different application types according to the application type and flow characteristic data of the data flow; and determine whether the data flow is normal by combining all abnormal probabilities; S5-4, judging whether the data flow is normal according to the application type and flow characteristic data of the data flow. According to the method for packet detection and analysis based on deep flow inspection of claim 5, it is characterized in that in step S5-2, the application type of the data flow is first determined by the supervised classification model, which specifically includes the following steps: S6-1, obtaining historical data flow information, including flow characteristics and application types of data flows; S6-2, for each application type, a binary classification model is trained with the flow features of the historical data flow as input and the application type as output, and a total of n binary classification models are obtained, where n is the number of application types; S6-3, input the flow characteristics of the current data flow into n binary classification models to determine one or more application types that are consistent with the flow characteristics of the current data flow. According to the method for packet detection and analysis based on deep flow detection according to claim 6, its characteristics are The feature is that, in step S5-3, determining the probability that the data flow belongs to each application type includes the following steps: S7-1, _a1 , _a2 , ... _am represent the elements corresponding to the data flow application type determined for the first time, where m is the number of application types that match the flow characteristics of the current data flow; when m is 2, the elements corresponding to the data flow application type are _a1 and _a2 ; S7-2, X ₁ , X ₂ , ...X _k represent the flow characteristics of the data flow, Y represents the random variable of the application type, the value range of Y is {a ₁ , a ₂ , ... _am }, and k is the number of flow characteristics; S7-3, calculating the probability _Pa1 , _Pa2 , ...Pam that the data flow belongs to application types _a1 , _a2 , ... _{am ;} Calculate m conditional probabilities, Determine Pa ₁ , Pa ₂ , ... Pa _m , The value range of i is a positive integer between the interval [1, m]; S7-4, fill Pa ₁ , Pa ₂ , ...Pa _m into the corresponding positions of the second row in the 3×n-order matrix. According to the method for packet detection and analysis based on deep flow inspection of claim 7, it is characterized in that in step S5-3, the determining of the probability of abnormality when the data flow belongs to different application types comprises the following steps: S8-1, taking the flow characteristics of the current data flow and the flow characteristics of the historical data flow as input, performing unsupervised classification, and determining the classification cluster to which the flow characteristics of the current data flow belong; S8-2, in the classification cluster to which the flow characteristics of the current data flow belong, find the flow characteristic data of application types _a1 , _a2 , ... _am , and record them as The superscript indicates the application type of the flow feature data, and the subscripts b ₁ , b ₂ , ... b _m respectively indicate the number of flow feature data with application types a ₁ , a ₂ , ... a _m in the classification cluster to which the flow feature of the current data flow belongs; S8-3, for each flow feature data in step S8-2, calculate the probability of abnormality, denoted as S8-4, determine the probability that each application type _a1 , _a2 , ... _am is abnormal In the formula is the connection weight of the stream feature data; Fill in the corresponding position of the third row in the 3×n-order matrix; S8-5, calculate the probability PE of the current data flow being abnormal, If PE is greater than or equal to the threshold, it is determined that the data flow generated when the current message is transmitted in the network is abnormal. If PE is less than the threshold, it is determined that the data flow generated when the current message is transmitted in the network is normal. According to the packet detection and analysis method based on deep flow inspection of claim 8, it is characterized in that in step S8-4, the connection weight of the flow feature data is determined by the following steps: Calculate flow characteristic data The Euclidean distance between the stream feature data of the current data stream and the Euclidean distance is recorded as Map the Euclidean distance through the anti-correlation function f and get Calculate the weight of each stream feature data In the summation formula, j only represents a serial number and has no practical meaning. According to the method for packet detection and analysis based on deep flow inspection of claim 9, it is characterized in that in step S8-3, for each flow feature data in step S8-2, calculating the probability of abnormality comprises the following steps: by represents any stream feature data, the value range of x is a positive integer between [1, _bi ]; in the stream feature data of the historical data stream of application type a _i , determine The total number of the same stream feature data, The number of times the same flow feature data is abnormal, and the ratio of the abnormal number to the total number is calculated. As stream feature data abnormal probability.